#!/bin/bash
NOW_DIR=$(cd "$(dirname "$0")";pwd)
ROOT_DIR=$(cd ~ && pwd)

[ -z "$admin" ] && admin=${ROOT_DIR##*/}

function goto_err()
{
    [ -n "$1" ] && echo $1
    exit
}

function copy_file
{
    [ -z "$file" ] && exit
    rm -rf "$tar_dir"
    mkdir -p "$tar_dir"
    cp -f $file "$tar_dir"

    chown -R $admin "$tar_dir"
    chmod 700 "$tar_dir"/*

    echo "cp -f $file  $tar_dir"
}


function net_mask2number
{
    [ -z "$1" ] && echo 16 && return
    local temp=$(echo "$1" | awk -F "." '{print $1" "$2" "$3" "$4}')
    for num in $temp;
        do
        while [ $num != 0 ];do
        echo -n $(($num%2)) >> /tmp/num;
        num=$(($num/2));
        done
    done

    local maskNum=$(grep -o "1" /tmp/num | wc -l)
    rm -rf /tmp/num

    [ $maskNum != 2 ] || maskNum=$1
    echo $maskNum
}

function update_openiptable
{
    local openiptable=/etc/systemd/system/openvpn-iptables.service
    local conf=/etc/openvpn/server/server.conf
    if systemctl is-active --quiet firewalld.service; then
        return
    fi
    local port=$(grep '^port ' $conf | cut -d " " -f 2)
	local protocol=$(grep '^proto ' $conf | cut -d " " -f 2)
    local ip=$(grep '^server ' $conf | cut -d " " -f 2)
    local mask=$(grep '^server ' $conf | cut -d " " -f 3)
    local net=$ip/$(net_mask2number $mask)
    local ip_local=$(grep '^local ' $conf | cut -d " " -f 2)

    # Create a service to set up persistent iptables rules
    local iptables_path=$(command -v iptables)
    local ip6tables_path=$(command -v ip6tables)
   
    # nf_tables is not available as standard in OVZ kernels. So use iptables-legacy
    # if we are in OVZ, with a nf_tables backend and iptables-legacy is available.
    if [[ $(systemd-detect-virt) == "openvz" ]] && readlink -f "$(command -v iptables)" | grep -q "nft" && hash iptables-legacy 2>/dev/null; then
        iptables_path=$(command -v iptables-legacy)
        ip6tables_path=$(command -v ip6tables-legacy)
    fi

sudo echo "[Unit]
Before=network.target
[Service]
Type=oneshot
ExecStart=$iptables_path -t nat -A POSTROUTING -s $net ! -d $net -j SNAT --to $ip_local
ExecStart=$iptables_path -I INPUT -p $protocol --dport $port -j ACCEPT
ExecStart=$iptables_path -I FORWARD -s $net -j ACCEPT
ExecStart=$iptables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
ExecStop=$iptables_path -t nat -D POSTROUTING -s $net ! -d $net -j SNAT --to $ip_local
ExecStop=$iptables_path -D INPUT -p $protocol --dport $port -j ACCEPT
ExecStop=$iptables_path -D FORWARD -s $net -j ACCEPT
ExecStop=$iptables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" > $openiptable

# 		if [[ -n "$ip6" ]]; then
# echo "ExecStart=$ip6tables_path -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
# ExecStart=$ip6tables_path -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
# ExecStart=$ip6tables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
# ExecStop=$ip6tables_path -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
# ExecStop=$ip6tables_path -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
# ExecStop=$ip6tables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" >> $openiptable
# 		fi

echo "RemainAfterExit=yes
[Install]
WantedBy=multi-user.target" >> $openiptable

    sudo systemctl enable --now openvpn-iptables.service
}

function vpn_restart
{
    sudo systemctl disable --now openvpn-server@server.service
    sleep 1
    sudo systemctl enable --now openvpn-server@server.service
}






